Can someone please help me finish an alert I am trying to do below? I would like to set the alert to notify me once the count reaches 10k and then send me a list of the top 10 SRC_IPs. However, when I put in the search
count > 10000, it removed the src_ip entries.
Here is my search string so far.
sourcetype="cisco:asa" action=blocked | stats count by src_ip, dest_ip, dest_port | sort - by count | rename src_ip as Src, dest_ip as Dest, dest_port as Port | addcoltotals
you could just set the number of results in the alert triggers wizard to 10000 events?
then just use something like
index = _internal | stats count by source | top limit=5 source
so you would have
my_awesome_search | top limit=10 Src
But that the problem. When I put the 10k in the alert trigger, it's just like putting it in the search string where it then removed all other records. I would also need the top 5 plus a line totalling the OTHER count as well.